create_dnssec_record
Submit a DNSSEC DS record to the registry to publish chain-of-trust for a signed domain using custom nameservers.
Instructions
Submit a DNSSEC DS record to the registry for a domain. Use when you sign DNS yourself (custom nameservers running BIND/Knot/PowerDNS/etc.) and need to publish the chain-of-trust at the parent zone. Required: keyTag, algorithm, digestType, digest. Optional key-data fields for registries that require full DNSKEY (rare).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain to add the DS record to. | |
| keyTag | Yes | DNSSEC key tag (16-bit identifier of the key). | |
| alg | Yes | Algorithm number, e.g. `13` for ECDSA P-256 SHA-256, `8` for RSA SHA-256. | |
| digestType | Yes | Digest type, e.g. `2` for SHA-256, `4` for SHA-384. | |
| digest | Yes | Hex-encoded DS digest value. | |
| maxSigLife | No | Maximum signature lifetime in seconds (registry-specific, optional). | |
| keyDataFlags | No | DNSKEY flags (optional — typically 256 or 257). | |
| keyDataProtocol | No | DNSKEY protocol (optional — almost always 3). | |
| keyDataAlgo | No | DNSKEY algorithm (optional). | |
| keyDataPubKey | No | Base64-encoded public key (optional). |